ci: pin GitHub Actions to commit SHA

[sobhe-Starkware]

No description provided.

[cursor]

PR Summary

Low Risk
Mechanical reference pinning with no application or CI behavior changes; standard hardening for workflows that already use the same action versions.

Overview
Pins third-party uses: references across CI workflows from mutable version tags (e.g. @v6, @v2) to immutable full commit SHAs, with inline comments preserving the original tag for readability.

Coverage spans the main CI surface: checkout/setup-python, Graphite CI optimizer, Google Cloud auth/upload/setup-gcloud, Docker build/login/metadata, artifact upload/download, merge-gatekeeper, stale/lock maintenance, k3d/foundry tooling, Slack notifications, and Starkware-specific comment/benchmark actions. Papyrus workflows pin to the actions/checkout@v4 SHA where those files still use v4.

No workflow logic, job graphs, or step inputs change—only how action versions are resolved at runtime, reducing risk of tag-moving supply-chain attacks.

^{Reviewed by Cursor Bugbot for commit 3592229. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[github-actions]

Artifacts upload workflows:

• Started at 2026-07-23T11:02:44Z
• Started at 2026-07-23T12:23:17Z